[PATCH v3 1/4] leds: cobalt-raq: Add missing MODULE_DESCRIPTION

[PATCH v3 1/4] leds: cobalt-raq: Add missing MODULE_DESCRIPTION

[Arunachalam]

Add the missing MODULE_DESCRIPTION() macro, which is required by
modpost and was missing from this driver.

Signed-off-by: Arunachalam <arun07172003@gmail.com>
---
 drivers/leds/leds-cobalt-raq.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/leds/leds-cobalt-raq.c b/drivers/leds/leds-cobalt-raq.c
index 045c239c7..5b5acaa8c 100644
--- a/drivers/leds/leds-cobalt-raq.c
+++ b/drivers/leds/leds-cobalt-raq.c
@@ -101,5 +101,5 @@ static struct platform_driver cobalt_raq_led_driver = {
 		.name	= "cobalt-raq-leds",
 	},
 };
-
+MODULE_DESCRIPTION("LEDs driver for the Cobalt Raq series");
 builtin_platform_driver(cobalt_raq_led_driver);
-- 
2.39.5

[PATCH v3 2/4] leds: lp8788: Convert to dev_err_probe()

[Arunachalam]

Replace open-coded dev_err() + return patterns with dev_err_probe(),
which also handles -EPROBE_DEFER correctly.

Signed-off-by: Arunachalam <arun07172003@gmail.com>
---
 drivers/leds/leds-lp8788.c | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/drivers/leds/leds-lp8788.c b/drivers/leds/leds-lp8788.c
index 9b9525ccc..259ac50e8 100644
--- a/drivers/leds/leds-lp8788.c
+++ b/drivers/leds/leds-lp8788.c
@@ -143,16 +143,12 @@ static int lp8788_led_probe(struct platform_device *pdev)
 	mutex_init(&led->lock);
 
 	ret = lp8788_led_init_device(led, led_pdata);
-	if (ret) {
-		dev_err(dev, "led init device err: %d\n", ret);
-		return ret;
-	}
+	if (ret)
+		return dev_err_probe(dev, ret, "led init device err\n");
 
 	ret = devm_led_classdev_register(dev, &led->led_dev);
-	if (ret) {
-		dev_err(dev, "led register err: %d\n", ret);
-		return ret;
-	}
+	if (ret)
+		return dev_err_probe(dev, ret, "led register err\n");
 
 	return 0;
 }
-- 
2.39.5

[PATCH v3 3/4] leds: menf21bmc: Convert to dev_err_probe()

[Arunachalam]

Replace open-coded dev_err() + return pattern with dev_err_probe(),
which also handles -EPROBE_DEFER correctly.

Signed-off-by: Arunachalam <arun07172003@gmail.com>
---
 drivers/leds/leds-menf21bmc.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/leds/leds-menf21bmc.c b/drivers/leds/leds-menf21bmc.c
index 6b1b47160..a7e4db487 100644
--- a/drivers/leds/leds-menf21bmc.c
+++ b/drivers/leds/leds-menf21bmc.c
@@ -84,10 +84,8 @@ static int menf21bmc_led_probe(struct platform_device *pdev)
 		leds[i].cdev.brightness_set = menf21bmc_led_set;
 		leds[i].i2c_client = i2c_client;
 		ret = devm_led_classdev_register(&pdev->dev, &leds[i].cdev);
-		if (ret < 0) {
-			dev_err(&pdev->dev, "failed to register LED device\n");
-			return ret;
-		}
+		if (ret < 0)
+			return dev_err_probe(&pdev->dev, ret, "failed to register LED device\n");
 	}
 	dev_info(&pdev->dev, "MEN 140F21P00 BMC LED device enabled\n");
 
-- 
2.39.5

[PATCH v3 4/4] leds: 88pm860x: Convert to dev_err_probe()

[Arunachalam]

Replace open-coded dev_err() + return patterns with dev_err_probe(),
which also handles -EPROBE_DEFER correctly.

Signed-off-by: Arunachalam <arun07172003@gmail.com>
---
 drivers/leds/leds-88pm860x.c | 18 ++++++------------
 1 file changed, 6 insertions(+), 12 deletions(-)

diff --git a/drivers/leds/leds-88pm860x.c b/drivers/leds/leds-88pm860x.c
index ef5c6c466..65f2af134 100644
--- a/drivers/leds/leds-88pm860x.c
+++ b/drivers/leds/leds-88pm860x.c
@@ -152,16 +152,12 @@ static int pm860x_led_probe(struct platform_device *pdev)
 	if (data == NULL)
 		return -ENOMEM;
 	res = platform_get_resource_byname(pdev, IORESOURCE_REG, "control");
-	if (!res) {
-		dev_err(&pdev->dev, "No REG resource for control\n");
-		return -ENXIO;
-	}
+	if (!res)
+		return dev_err_probe(&pdev->dev, -ENXIO, "No REG resource for control\n");
 	data->reg_control = res->start;
 	res = platform_get_resource_byname(pdev, IORESOURCE_REG, "blink");
-	if (!res) {
-		dev_err(&pdev->dev, "No REG resource for blink\n");
-		return -ENXIO;
-	}
+	if (!res)
+		return dev_err_probe(&pdev->dev, -ENXIO, "No REG resource for blink\n");
 	data->reg_blink = res->start;
 	memset(data->name, 0, MFD_NAME_SIZE);
 	switch (pdev->id) {
@@ -203,10 +199,8 @@ static int pm860x_led_probe(struct platform_device *pdev)
 	mutex_init(&data->lock);
 
 	ret = led_classdev_register(chip->dev, &data->cdev);
-	if (ret < 0) {
-		dev_err(&pdev->dev, "Failed to register LED: %d\n", ret);
-		return ret;
-	}
+	if (ret < 0)
+		return dev_err_probe(&pdev->dev, ret, "Failed to register LED\n");
 	pm860x_led_set(&data->cdev, 0);
 
 	platform_set_drvdata(pdev, data);
-- 
2.39.5

Re: [PATCH v3 4/4] leds: 88pm860x: Convert to dev_err_probe()

[sashiko-bot]

> Replace open-coded dev_err() + return patterns with dev_err_probe(),
> which also handles -EPROBE_DEFER correctly.
> 
> Signed-off-by: Arunachalam <arun07172003@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260725081349.8556-1-arun07172003@gmail.com?part=4

Re: [PATCH v3 3/4] leds: menf21bmc: Convert to dev_err_probe()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The `menf21bmc_led_set` function sleeps but is incorrectly assigned to the non-blocking `brightness_set` callback.
--

--- Patch [3]: [PATCH v3 3/4] leds: menf21bmc: Convert to dev_err_probe() ---
commit 47baf6269572a611e45209e561552d7a4bd3af39
Author: Arunachalam <arun07172003@gmail.com>

leds: menf21bmc: Convert to dev_err_probe()
    
Replace open-coded dev_err() + return pattern with dev_err_probe(),
which also handles -EPROBE_DEFER correctly.

> diff --git a/drivers/leds/leds-menf21bmc.c b/drivers/leds/leds-menf21bmc.c
> index 6b1b471606026..a7e4db4879d81 100644
> --- a/drivers/leds/leds-menf21bmc.c
> +++ b/drivers/leds/leds-menf21bmc.c
> @@ -84,10 +84,8 @@ static int menf21bmc_led_probe(struct platform_device *pdev)
>  		leds[i].cdev.brightness_set = menf21bmc_led_set;

[Severity: High]
This is a pre-existing issue, but does assigning this to brightness_set instead
of brightness_set_blocking risk a scheduling while atomic bug?

The menf21bmc_led_set() function acquires a mutex and calls sleeping I2C
functions:

drivers/leds/leds-menf21bmc.c:menf21bmc_led_set() {
    ...
	mutex_lock(&led_lock);
	led_val = i2c_smbus_read_byte_data(led->i2c_client,
					   BMC_CMD_LED_GET_SET);
    ...
}

If an atomic-context trigger like 'timer' or 'heartbeat' is selected for this
LED via sysfs, the LED core could call this non-blocking hook from an atomic
context, which can crash the system.

>  		leds[i].i2c_client = i2c_client;
>  		ret = devm_led_classdev_register(&pdev->dev, &leds[i].cdev);
> -		if (ret < 0) {
> -			dev_err(&pdev->dev, "failed to register LED device\n");
> -			return ret;
> -		}
> +		if (ret < 0)
> +			return dev_err_probe(&pdev->dev, ret, "failed to register LED device\n");
>  	}
>  	dev_info(&pdev->dev, "MEN 140F21P00 BMC LED device enabled\n");
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260725081349.8556-1-arun07172003@gmail.com?part=3

Re: [PATCH v3 1/4] leds: cobalt-raq: Add missing MODULE_DESCRIPTION

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Use-After-Unmap and orphaned LED classdevs due to missing .remove callback combined with unmanaged led_classdev_register.
--

--- Patch [1]: [PATCH v3 1/4] leds: cobalt-raq: Add missing MODULE_DESCRIPTION ---
commit d2016764a88879b346e156b26cea14e3d81dd4b0
Author: Arunachalam <arun07172003@gmail.com>

leds: cobalt-raq: Add missing MODULE_DESCRIPTION

Add the missing MODULE_DESCRIPTION() macro, which is required by
modpost and was missing from this driver.

> diff --git a/drivers/leds/leds-cobalt-raq.c b/drivers/leds/leds-cobalt-raq.c
> --- a/drivers/leds/leds-cobalt-raq.c
> +++ b/drivers/leds/leds-cobalt-raq.c
> @@ -101,5 +101,5 @@ static struct platform_driver cobalt_raq_led_driver = {
>  		.name	= "cobalt-raq-leds",
>  	},
>  };

[Severity: High]
This isn't a bug introduced by this patch, but is a pre-existing flaw in
the driver.

Does this driver leave orphaned LED classdevs if it is unbound via sysfs?

The LEDs are registered in cobalt_raq_led_probe() using the unmanaged
led_classdev_register() API, but the driver definition here lacks a .remove
callback.

If a privileged user unbinds the driver, the devres cleanup will unmap
led_port. Because the LEDs are not unregistered, they will remain in the
subsystem. Any subsequent access to the sysfs brightness files will execute
raq_power_off_led_set() or raq_web_led_set() and attempt to write to the
unmapped led_port pointer, causing an invalid memory access.

Should this driver be updated to use devm_led_classdev_register() during
probe, or have a .remove callback added to ensure symmetric cleanup?

> -
> +MODULE_DESCRIPTION("LEDs driver for the Cobalt Raq series");
>  builtin_platform_driver(cobalt_raq_led_driver);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260725081349.8556-1-arun07172003@gmail.com?part=1

Re: [PATCH v3 2/4] leds: lp8788: Convert to dev_err_probe()

[sashiko-bot]

> Replace open-coded dev_err() + return patterns with dev_err_probe(),
> which also handles -EPROBE_DEFER correctly.
> 
> Signed-off-by: Arunachalam <arun07172003@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260725081349.8556-1-arun07172003@gmail.com?part=2

[PATCH 1/2] leds: menf21bmc: Use brightness_set_blocking instead of brightness_set

[Arunachalam]

menf21bmc_led_set() takes a mutex and performs an I2C transaction, both
of which can sleep. It was assigned to the non-blocking brightness_set
callback, which the LED core may invoke from atomic context (e.g. via
the timer or heartbeat triggers), risking a scheduling-while-atomic bug.

Switch to brightness_set_blocking, which the LED core dispatches from
a workqueue in safe, sleepable context. This also allows propagating
I2C failures via the function's return value instead of silently
discarding them.

Signed-off-by: Arunachalam <arun07172003@gmail.com>
---
 drivers/leds/leds-menf21bmc.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/leds/leds-menf21bmc.c b/drivers/leds/leds-menf21bmc.c
index a7e4db487..6b09e433a 100644
--- a/drivers/leds/leds-menf21bmc.c
+++ b/drivers/leds/leds-menf21bmc.c
@@ -49,7 +49,7 @@ static struct menf21bmc_led leds[] = {
 
 static DEFINE_MUTEX(led_lock);
 
-static void
+static int
 menf21bmc_led_set(struct led_classdev *led_cdev, enum led_brightness value)
 {
 	int led_val;
@@ -67,10 +67,11 @@ menf21bmc_led_set(struct led_classdev *led_cdev, enum led_brightness value)
 	else
 		led_val |= led->led_bit;
 
-	i2c_smbus_write_byte_data(led->i2c_client,
+	led_val = i2c_smbus_write_byte_data(led->i2c_client,
 				  BMC_CMD_LED_GET_SET, led_val);
 err_out:
 	mutex_unlock(&led_lock);
+	return led_val;
 }
 
 static int menf21bmc_led_probe(struct platform_device *pdev)
@@ -81,7 +82,7 @@ static int menf21bmc_led_probe(struct platform_device *pdev)
 
 	for (i = 0; i < ARRAY_SIZE(leds); i++) {
 		leds[i].cdev.name = leds[i].name;
-		leds[i].cdev.brightness_set = menf21bmc_led_set;
+		leds[i].cdev.brightness_set_blocking = menf21bmc_led_set;
 		leds[i].i2c_client = i2c_client;
 		ret = devm_led_classdev_register(&pdev->dev, &leds[i].cdev);
 		if (ret < 0)
-- 
2.39.5

[PATCH 2/2] leds: cobalt-raq: Use devm_led_classdev_register() to fix use-after-unmap

[Arunachalam]

The driver had no .remove callback, but registered its LEDs with the
unmanaged led_classdev_register() while the I/O mapping for led_port
was already managed via devres. If the driver was unbound, devres
would unmap led_port, but the LED classdevs would remain registered
with no matching teardown. A subsequent sysfs brightness write would
then dereference the now-unmapped led_port pointer.

Switch to devm_led_classdev_register() so LED registration and the
I/O mapping share the same devres lifetime and are torn down in the
correct order automatically.

Signed-off-by: Arunachalam <arun07172003@gmail.com>
---
 drivers/leds/leds-cobalt-raq.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/drivers/leds/leds-cobalt-raq.c b/drivers/leds/leds-cobalt-raq.c
index 5b5acaa8c..ecb64ca9d 100644
--- a/drivers/leds/leds-cobalt-raq.c
+++ b/drivers/leds/leds-cobalt-raq.c
@@ -76,19 +76,16 @@ static int cobalt_raq_led_probe(struct platform_device *pdev)
 	if (!led_port)
 		return -ENOMEM;
 
-	retval = led_classdev_register(&pdev->dev, &raq_power_off_led);
+	retval = devm_led_classdev_register(&pdev->dev, &raq_power_off_led);
 	if (retval)
 		goto err_null;
 
-	retval = led_classdev_register(&pdev->dev, &raq_web_led);
+	retval = devm_led_classdev_register(&pdev->dev, &raq_web_led);
 	if (retval)
-		goto err_unregister;
+		goto err_null;
 
 	return 0;
 
-err_unregister:
-	led_classdev_unregister(&raq_power_off_led);
-
 err_null:
 	led_port = NULL;
 
-- 
2.39.5